I am building an entirely private site where only the wp-login.php page can be viewed by non-logged-in users.
After an entire day of debugging I've come to realize that non-logged-in user visits are what trigger wp_cron scheduled actions.
Even though none of the documentation suggests this, and neither did I even find anything about this when reading the core code, my testing is very consistent in showing this result.
My question is: how can I fire cron jobs created with wp_schedule_event on a site that does not allow non-user visitors?
It turns out that my privatizing script was causing the issue because I was loading on the "init" action hook. Checking for is_logged_in on "parse_request" kept the site secure while still allowing cron to run. The issue was that wp_cron runs on "init" also.